Normalising Lustre Preserves Security

• Published in: Theoretical Aspects of Computing - ICTAC 2021 Vol. 12819; pp. 275 - 292
• Main Authors: Prasad, Sanjiva, Yerraguntla, R. Madhukar
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2021; Springer International Publishing
• Series: Lecture Notes in Computer Science
• Subjects: Compiler transformation; Non-interference; Security preservation; Security type system; Synchronous reactive data flow
• ISBN: 3030853144; 9783030853143
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-030-85315-0_16

The synchronous reactive data flow language Lustre is an expressive language, equipped with a suite of tools for modelling, simulating and model-checking a wide variety of safety-critical systems. A critical intermediate step in the formally certified compilation of Lustre involves translation to a well-behaved sub-language called “Normalised Lustre” (NLustre). Recently, we proposed a simple Denning-style lattice-based secure information flow type system for NLustre, and proved its soundness by establishing that security-typed programs are non-interfering with respect to the co-inductive stream semantics. In this paper, we propose a similar security type system for unrestricted Lustre, and show that Bourke et al.’s semantics-preserving normalisation transformations from Lustre to NLustre are security-preserving as well. A novelty is the use of refinement security types for node calls. The main result is the preservation of security types by the normalisation transformations. The soundness of our security typing rules is shown by establishing that well-security-typed programs are non-interfering, via a reduction to type-preservation (here), semantics-preservation (Bourke et al.) and our previous result of non-interference for NLustre.